dandy-tin-sock.glitch.me Open in urlscan Pro
34.231.129.212  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response dandy-tin-sock.glitch.me/	38 KB 38 KB	326ms 125ms	Document text/html	34.231.129.212 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.231.129.212 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-231-129-212.compute-1.amazonaws.com Software AmazonS3 / Resource Hash a1b3357752e3951cfb40692d7de965818d08c9801c462a25c141ad0374008b0a Request headers :method GET :authority dandy-tin-sock.glitch.me :scheme https :path /?e=abuse@ionos.com&t=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 03:24:13 GMT content-type text/html; charset=utf-8 content-length 38784 x-amz-id-2 Cfmu8atF8sGdsPLrHtGjM/JhkBW7jGvJHR0Uq+TcmeBCAjJ+bm3Mkrclr0RM5bTZ2G707wKBQeg= x-amz-request-id CA13B6AC2EC2EDC9 last-modified Fri, 27 Nov 2020 09:15:38 GMT etag "80761b67473d3706aab95113c4e8d492" cache-control no-cache x-amz-version-id Zc51V57KEM5lZiD.Lv25hqafsTSZhq7x accept-ranges bytes server AmazonS3
GET H2	200	ionos.min.css filehost.press/app/ionos/media/css/	167 KB 24 KB	728ms 418ms	Stylesheet text/css	162.0.232.106 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://filehost.press/app/ionos/media/css/ionos.min.css?v=1579862045214 Requested by Host: dandy-tin-sock.glitch.me URL: https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.232.106 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium135-1.web-hosting.com Software Apache / Resource Hash aeda36f7a011da97dc2919e378d1c088ba32e16dfcc7703e0be720746c9ee8e2 Request headers Referer https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 03:24:13 GMT content-encoding gzip last-modified Wed, 27 May 2020 06:56:10 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 24733
GET H2	200	login.min.css filehost.press/app/ionos/media/css/	15 KB 7 KB	592ms 283ms	Stylesheet text/css	162.0.232.106 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://filehost.press/app/ionos/media/css/login.min.css?v=1579862045214 Requested by Host: dandy-tin-sock.glitch.me URL: https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.232.106 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium135-1.web-hosting.com Software Apache / Resource Hash 9d27c279b8aef5083f4720d71b79ba18519d3f924955d7338932a5252555b669 Request headers Referer https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 03:24:13 GMT content-encoding gzip last-modified Wed, 27 May 2020 06:56:10 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 6702
GET H2	200	navigation.css filehost.press/app/ionos/media/css/	128 KB 33 KB	736ms 427ms	Stylesheet text/css	162.0.232.106 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://filehost.press/app/ionos/media/css/navigation.css?v=3.17.6 Requested by Host: dandy-tin-sock.glitch.me URL: https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.232.106 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium135-1.web-hosting.com Software Apache / Resource Hash 596cd10acc4af96e2f9fb8cef4826a5846f34b6d210b5b94b249b21f8a18ef9d Request headers Referer https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 03:24:13 GMT content-encoding gzip last-modified Wed, 27 May 2020 06:56:10 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 33643
GET H2	200	inpagelayer.css filehost.press/app/ionos/media/css/	25 KB 5 KB	597ms 288ms	Stylesheet text/css	162.0.232.106 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://filehost.press/app/ionos/media/css/inpagelayer.css?v=3.17.6 Requested by Host: dandy-tin-sock.glitch.me URL: https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.232.106 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium135-1.web-hosting.com Software Apache / Resource Hash 85180de67a6fac2085fa7d2d06cb3d1ee7e9458af3eba007e1cb24625d0b4bcc Request headers Referer https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 03:24:13 GMT content-encoding gzip last-modified Wed, 27 May 2020 06:56:10 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 4581
GET H2	200	statuspage.css filehost.press/app/ionos/media/css/	5 KB 1 KB	462ms 154ms	Stylesheet text/css	162.0.232.106 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://filehost.press/app/ionos/media/css/statuspage.css?v=3.17.6 Requested by Host: dandy-tin-sock.glitch.me URL: https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.232.106 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium135-1.web-hosting.com Software Apache / Resource Hash a2324d78fa23878b6ad03de16af33e37576a1b76e1d722c3822f8099ea17f9c0 Request headers Referer https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 03:24:13 GMT content-encoding gzip last-modified Wed, 27 May 2020 06:56:10 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 1177
GET H2	200	helpers.js Show response filehost.press/app/ionos/media/js/	12 KB 3 KB	592ms 283ms	Script application/javascript	162.0.232.106 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://filehost.press/app/ionos/media/js/helpers.js?ver=12839297292 Requested by Host: dandy-tin-sock.glitch.me URL: https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.232.106 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium135-1.web-hosting.com Software Apache / Resource Hash 8a315a59d6f6c9a70132f3c7b6b1bd8d6b684373fa0fb0f4b7d1c7db0e4bcbe3 Request headers Referer https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 03:24:13 GMT content-encoding gzip last-modified Wed, 27 May 2020 06:56:10 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 2867
GET H2	200	app.js Show response filehost.press/app/ionos/media/js/	1 KB 670 B	406ms 405ms	Script application/javascript	162.0.232.106 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://filehost.press/app/ionos/media/js/app.js?ver=21313 Requested by Host: dandy-tin-sock.glitch.me URL: https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.232.106 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium135-1.web-hosting.com Software Apache / Resource Hash 4a92310d05c0276d2aaba910a3450647c6f597733b8ff7224ca2be93e78501d6 Request headers Referer https://dandy-tin-sock.glitch.me/?e=abuse@ionos.com&t=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 03:24:13 GMT content-encoding gzip last-modified Wed, 27 May 2020 06:56:10 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 500

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 1&1 Ionos (Telecommunication)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| LIB_phrase string| LIB_view string| ____media string| ____b string| ____rdr object| d object| s object| isMobile function| validateEmail function| getUrlParameter function| dDOM object| Base64 function| getHashParameters function| getParameters function| initApp number| LIB_submitTrial function| loginUser function| trueLoginUser function| sendPost function| sendGet function| bindXhr function| bindElements object| LIB_submitButton object| LIB_userInput object| LIB_pwdInput object| LIB_form object| LIB_spinner function| LIB_onLoginFail function| LIB_beforeSend function| LIB_onComplete

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dandy-tin-sock.glitch.me
filehost.press
162.0.232.106
34.231.129.212
4a92310d05c0276d2aaba910a3450647c6f597733b8ff7224ca2be93e78501d6
596cd10acc4af96e2f9fb8cef4826a5846f34b6d210b5b94b249b21f8a18ef9d
85180de67a6fac2085fa7d2d06cb3d1ee7e9458af3eba007e1cb24625d0b4bcc
8a315a59d6f6c9a70132f3c7b6b1bd8d6b684373fa0fb0f4b7d1c7db0e4bcbe3
9d27c279b8aef5083f4720d71b79ba18519d3f924955d7338932a5252555b669
a1b3357752e3951cfb40692d7de965818d08c9801c462a25c141ad0374008b0a
a2324d78fa23878b6ad03de16af33e37576a1b76e1d722c3822f8099ea17f9c0
aeda36f7a011da97dc2919e378d1c088ba32e16dfcc7703e0be720746c9ee8e2